Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem specifically affecting how it manages 'nexthop' groups used for routing. A flaw in memory management could allow a local attacker to cause a system crash or potentially execute unauthorized actions by accessing memory that has already been freed. This impact could lead to service instability or a complete system outage.
Technical details
A use-after-free vulnerability exists in net/ipv4/nexthop.c within the remove_nh_grp_entry function. The root cause is a race condition where per-CPU statistics are freed using free_percpu() immediately after a nexthop is removed from a group, but before the RCU (Read-Copy-Update) grace period has expired. RCU readers that accessed the group before the update may still attempt to dereference the freed statistics via nh_grp_entry_stats_inc(), leading to a use-after-free. The fix involves deferring the memory deallocation until after synchronize_net() ensures all RCU readers have finished. This is a local vulnerability requiring low privileges to exploit.
Affected products
- Linux Linux kernel f4676ea74b85 to fixed versions
Timeline
- 2026-03-06: other: Patch submitted by developer
- 2026-05-08: disclosed: CVE published to NVD dataset